1697 matches found
Cross site request forgery (csrf)
fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service...
CVE-2021-29624 Lack of protection against cookie tossing attacks in fastify-csrf
fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service...
CVE-2021-29624: Reliance on Cookies without Validation and Integrity Checking
fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service...
Fastify 跨站请求伪造漏洞
Fastify is an open source web framework for Node.js from the OpenJS Openjs Foundation. Node.js fastify suffers from a security vulnerability that allows an attacker to trigger cross-site request forgery via Cookie Double Submit in Node.js fastify-csrf in order to force the victim to perform an...
cookie tossing attack
Overview Users that used fastify-csrf with the "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Recommendation Upgrade to version 3.1.0 or later References - CVE - GitHub Advisory...
Lack of protection against cookie tossing attacks in fastify-csrf
Impact Users that used fastify-csrf with the "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Patches Version 3.1.0 of the fastify-csrf fixes it. See https://github.com/fastify/fastify-csrf/pull/51 and...
GHSA-RC4Q-9M69-GQP8 Lack of protection against cookie tossing attacks in fastify-csrf
Impact Users that used fastify-csrf with the "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Patches Version 3.1.0 of the fastify-csrf fixes it. See https://github.com/fastify/fastify-csrf/pull/51 and...
PT-2021-18374 · Unknown · Fastify-Csrf
Name of the Vulnerable Software and Affected Versions: fastify-csrf versions prior to 3.1.0 Description: The issue affects applications using the fastify-csrf plugin with the "double submit" mechanism, particularly those deployed across multiple subdomains. To fully implement protection, users of...
PT-2021-7997
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the calculation of report length in the hid submit ctrl function, which does not account for the possibility of a zero-sized report. When a report of size 0 is...
CVE-2020-13568
SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability in admin/editgroup.php, when the POST parameter action is “Submit”, the POST parameter parentid leads to a SQL...
DMA Radius Manager 4.4.0 - Cross-Site Request Forgery (CSRF)
Exploit Title: DMA Radius Manager 4.4.0 - Cross-Site Request Forgery CSRF Date: April 8, 2021 04/08/2021 Exploit Author: Issac Briones Vendor Homepage: http://www.dmasoftlab.com/ Software Download: https://sourceforge.net/projects/radiusmanager/ Version: 4.4.0 CVE: CVE-2021-30147 input...
CVE-2021-25278
FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor...
CVE-2021-25278
FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor...
Design/Logic Flaw
FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor...
CVE-2021-25278
The FTAPI vulnerability CVE-2021-25278 affects FTAPI versions 4.0–4.10 and is a cross-site scripting flaw in the Background Image upload feature of the Submit Box Template Editor. An attacker can exploit the issue by uploading an SVG file containing embedded JavaScript, which may compromise a vic...
CVE-2021-25278: Improper Neutralization of Input During Web Page Generation
FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor...
The vulnerabilities of the “/submit.php” and “/infusions/downloads/downloads.php” components of the PHP-Fusion CMS system allow attackers to execute arbitrary SQL queries.
The vulnerability of the “/submit.php” and “/infusions/downloads/downloads.php” components of the PHP-Fusion CMS system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL queries remotely...
HTCondor Access Control Error Vulnerability
HTCondor is a workload management system. HTCondor is vulnerable to an access control error, which could be exploited by remote attackers to submit special requests to submit jobs as other users...
CVE-2021-25312
HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS authentication method...
HTCondor 访问控制错误漏洞
HTCondor is a workload management system. HTCondor is vulnerable to an access control error, which could be exploited by remote attackers to submit special requests to submit jobs as other users...